{"record":{"id":"4bcb17dcac8bc73f","repo":"crowdsecurity/crowdsec","slug":"unable-to-load-outofband-rule-s-s","errorCode":null,"errorMessage":"unable to load outofband rule %s : %s","messagePattern":"unable to load outofband rule (.+?) : (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/appsec/appsec.go","lineNumber":945,"sourceCode":"\t\t\twc.DefaultRemediation, wc.Name, BanRemediation, CaptchaRemediation, AllowRemediation, ChallengeRemediation)\n\t}\n\n\tret.Name = wc.Name\n\tret.Config = wc\n\tret.DefaultRemediation = wc.DefaultRemediation\n\tret.BodySettings = BodySettings{\n\t\tMaxSize: DefaultMaxBodySize,\n\t\tAction:  BodySizeActionDrop,\n\t}\n\n\twc.Logger.Tracef(\"Loading config %+v\", wc)\n\t// load rules\n\tfor _, rule := range wc.OutOfBandRules {\n\t\twc.Logger.Infof(\"loading outofband rule %s\", rule)\n\n\t\tcollections, err := LoadCollection(rule, wc.Logger.WithField(\"component\", \"appsec_collection_loader\"), hub)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"unable to load outofband rule %s : %s\", rule, err)\n\t\t}\n\n\t\tret.OutOfBandRules = append(ret.OutOfBandRules, collections...)\n\t}\n\n\twc.Logger.Infof(\"Loaded %d outofband rules\", len(ret.OutOfBandRules))\n\n\tfor _, rule := range wc.InBandRules {\n\t\twc.Logger.Infof(\"loading inband rule %s\", rule)\n\n\t\tcollections, err := LoadCollection(rule, wc.Logger.WithField(\"component\", \"appsec_collection_loader\"), hub)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"unable to load inband rule %s : %s\", rule, err)\n\t\t}\n\n\t\tret.InBandRules = append(ret.InBandRules, collections...)\n\t}\n","sourceCodeStart":927,"sourceCodeEnd":963,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/appsec.go#L927-L963","documentation":"Returned by AppsecRuntimeConfig Build when loading an out-of-band (WAF) rule collection via LoadCollection fails. LoadCollection resolves the rule name against the hub and parses its YAML into rule collections; any resolution or parse failure is wrapped here. It blocks startup of the appsec engine for that config.","triggerScenarios":"Build() iterating wc.OutOfBandRules and calling LoadCollection(rule, ...) which errors because the collection name is not installed in the hub, the YAML file is malformed, or referenced expressions/parsers are missing.","commonSituations":"Referencing a non-existent collection in `outofband_rules:`; hub not synced/upgraded so files are missing; a custom rule YAML with invalid syntax; stale hub state after a version upgrade.","solutions":["Fix the rule name in the appsec-config's outofband_rules list (check spelling against `cscli collections list`)","Run `cscli hub update && cscli hub upgrade` and install the missing collection","Validate the custom rule YAML syntax and its referenced expressions","Check the wrapped error (%s) for the underlying cause — parse error vs not-found"],"exampleFix":"// before (appsec-config.yaml)\noutofband_rules:\n  - crowdsecurity/appsec-rule\n// after\noutofband_rules:\n  - crowdsecurity/appsec-rules","handlingStrategy":"validation","validationCode":"for _, rule := range cfg.OutOfBandRules {\n    if !cscliCollectionExists(rule) {\n        return fmt.Errorf(\"outofband rule %q not installed\", rule)\n    }\n}","typeGuard":null,"tryCatchPattern":"if _, err := buildAppsecRuntime(cfg); err != nil {\n    if strings.Contains(err.Error(), \"unable to load outofband rule\") {\n        log.Fatalf(\"fix outofband_rules entries / hub state: %v\", err)\n    }\n    return err\n}","preventionTips":["Install rule collections before referencing them in appsec-configs","Validate custom rule YAML with a parser before deploying","Keep hub files under version-controlled, tested deploys"],"tags":["appsec","rules","hub"],"backgroundTag":"resource-not-found","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}